An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
ASGI requests with a missing or understated Content-Length header can bypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into memory and causing service degradation.
As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Kyle Agronick for reporting this issue.
Weakness
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Django | Djangoproject | 5.2 (including) | 5.2.14 (excluding) |
| Django | Djangoproject | 6.0 (including) | 6.0.5 (excluding) |
| Python-django | Ubuntu | devel | * |
| Python-django | Ubuntu | esm-infra/xenial | * |
| Python-django | Ubuntu | jammy | * |
| Python-django | Ubuntu | noble | * |
| Python-django | Ubuntu | questing | * |
| Python-django | Ubuntu | resolute | * |
| Python-django | Ubuntu | upstream | * |